spam via private message

[Favaro]

I got spam via my private box from a user called brk303 advertising porn or something. Anyone else get this?

[GLH]

I got it to.
It was a screenshot of a site named Porntube, but the link behind was another site.
Haven't clicked it.

[TippeX]

same here..
also blazkowicz got one and pm'ed me about

current users who did it...

bonanza
babig
balogna
bahhab
bullpup
bob87

i've banned the first four, barry banned the 5th..... i suggest banning ANY account that did the same...
and for everyone who got these messages NOT to visit the site in the picture...

i'll sticky this thread so hopefully others will see it...

[Favaro]

I just got another one from the abit forums posting the same thing

[BarryB]

Yup, got one too! Gave an infraction for the user and banned him :)

[TippeX]

i think its a bot, random names and registration info, i saw faked join dates etc.. 2004, 2005, one was april 1st, another sept 25th, making it relatively tricky to track, ip's were also different... again, for anyone who gets it do NOT click the picture / link...

if anyone else gets them (i suspect it was a mass pm spam), post the user name here... (note: all so far are one time posters... )

[BarryB]

What if we ban all people with 1 post, we'll get all the spammers then :D

[TippeX]

heh my thoughts exactly :) but we might get some collateral damage

[Trooper1234]

i have get it also, but i clicked and it wanted to install a setup.exe. i tried to break up but i must start pc new, because firefox was not able to close, only if i download setup.exe. is there trojan now on my pc? :o

[TippeX]

lordy, why did you click?... and please post the name of the person who sent the pm to you, so we can clear things up...

if you didn't run the setup.exe then you should be ok, but i'd recommend scanning your pc NOW!

[Trooper1234]

name is bahhab, here is user profile:

http://fileforums.com/member.php?u=98960

no i didn´t run it but will scan now, you right, its saver.

[Joe Forster/STA]

I got one from 247ownz which is very weird as he has (a few) competely normal posts so I don't think he's a bot (and, therefore, haven't banned him yet). An alternative possibility could be that someone is finding out the password of forum members, who haven't used their accounts for a long time, and then using them for spamming.

[TippeX]

possible, or the person spamming is somehow infected, and this is a spreading method

[DABhand]

Add Balogna to the list.

[EMPiRE]

vB has been upgraded to the latest version, let's hope the spamming stops...

But it is always possible to have an automated system to spam users thru PM

I'll check if there is an option to stop new users from using pm until they have a valid number of posts (should be there I guess)

The existing spammers have also been ip banned

[Joe Forster/STA]

If it's possible, set a limit on how many PM's a forum member is allowed to send within a given amount of time. (Say, only one PM per minute.)

[Muji-FightR]

you might want to add bobdbuilder to the list :)

[TippeX]

he spammed you? or you just dont like him? ;)

[Bluegrass]

I got the same spam from 2Beer30

[Joe Forster/STA]

It is completely impossible that a group of very different forum members - different names, IP addresses and join dates - start spamming at the same time. I think there is a security hole in the forum software that allows someone to either A) create forum members with random data (name => okay, IP address => anonymous proxy, join date => ?!?!?!) or B) obtain the password of forum members who have been away for a long time.

If there's a backup of the member list from a few weeks/months ago then you could check whether these forum members have been already registered back then. That should differentiate between A) and B).

[TippeX]

i think its random accounts as you said, the join dates fluctuate too much, some going back to 2004 and the vast majority are 1 or 0 posters

[EMPiRE]

If it keeps happening too much there is a way to fix this (for now)

It is creating a new usergroup which has user with at least 5 posts, users are auto-promoted to this group when they reach this limit and then can use PM

This is a temporaty fix as these spambots can then create 5 posts and are then able to spam again...

[TippeX]

yeh daemon tools forum has something like that, where < 20 posts (or the person is a non customer) users are 'moderated' - their posts don't show up unless a moderator 'allows' them... a similar approach would be ideal in this scenario

[Grumpy]

Added bob87 to TippeX's list.
I got the same PM as GLH, Porn post. Got it on the 19th, but havent been here for a few days to notice it earlier.

Join Date: Jul 2007
Location: australia
Posts: 1

I havent banned the user as yet, was more curious to see if it happens again from the same users?

[TippeX]

1 poster doing pm i ban... after checking their post which is usually crap anyway...
while it is feasible clicking the link could infect the pc which in turn then does this spamming, its too 'random'
and if accounts were somehow compromised then it'd make more sense to try and use an adminstrator account as you could really make some havok then... but this doesnt seem to be the case...

[DABhand]

YouPorn the internets fastest way of infecting your PC. lol

[acal3000]

Ok I received one.

Dont know if was already reported but here is

http://fileforums.com/member.php?u=119168

Same porntube add as the rest of you

Ddidnt cliked the link either. Not insterested

[TippeX]

bliksem - 0 user post.. banned

[LoedD]

Same here..
user: brucec
Austalia
0 posts

[Joe Forster/STA]

brucec permbanned.

[Destructor2003]

I just got this:
Dear Destructor2003, You have received a new private message at FileForums from securemangr, entitled "Your computer was noticed in spam". To read the original version, respond to, or delete this message, you must log in here:http://fileforums.com/private.php This is the message that was sent:***************Hello, dear user. Your computer was noticed in spam. It is quite possible that it is a part of botnet (see http://en.wikipedia.org/wiki/Botnet). Strongly recommend you to scan your computer for trojan horses. For more info please visit http://***************/*********[SK]Darknagel;The Maistro;Destructor2003;PhAt EmSeeBi!;BlackJackPlease, follow this. Otherwise I have to send abuse mail to your ISP with all the ensuing consequences.*************** Again, please do not reply to this email. You must go to the following page to reply to this private message:http://fileforums.com/private.php All the best,FileForums

I don't mind if you need to delete my account as it's not a forum I use at the moment.

[clarky2k1]

hello today i receive this:Dear clarky2k1,

You have received a new private message at FileForums from WilliamDuncan, entitled "Take measures immediately!".

To read the original version, respond to, or delete this message, you must log in here:
http://fileforums.com/private.php

This is the message that was sent:
***************
Dear, mpeaslee;Raiden;ELMO;clarky2k1;nort!

A virus alert was noticed on your computer.
We highly recommend you to check your computer and perform online virus check at our site immediately: http://remove-malware.servebbs.org/online-scanner/mpeaslee;Raiden;ELMO;clarky2k1;nort
If you do not pass this test* we will have to delete your account and forward a complaint to your ISP with attached log file (your IP address, etc.).
----------------------------------------------------
Forum Administration fileforums.com

[Joe Forster/STA]

Yup, I also got one. User permbanned. ;)